Insider Threat Signature Developer (Senior)

About the role

Pueo, a national security cyber company, is looking for a Senior Insider Threat Signature Developer to join its team of multidisciplinary experts onsite in the National Capital Region (NCR). The role works closely with IC customer stakeholders to identify critical assets, assess threat vectors and recommend security technologies that strengthen an organization's insider threat posture. The developer designs, implements and maintains behavioral and rule-based signatures to detect insider threats, working with threat intelligence, security operations and engineering teams.

Key responsibilities

• Detection engineering: design, implement and maintain insider threat detection signatures based on organizational data, user behavior and access patterns, and validate and test them in controlled environments to reduce false positives
• Maintain versioned signature libraries with change tracking and rollback plans, and document detection logic, data sources and tuning parameters
• Align signatures with policies, acceptable use guidelines and incident response playbooks with the Insider Threat Program (ITP)
• Support incident investigations with signature-based evidence and alert analysis, conduct root cause analysis and track KPIs on detection effectiveness
• Ensure compliance with regulations and standards such as CNSS, ICDs and privacy obligations, and support internal and external audits

Required profile

• Active TS/SCI clearance with the ability to obtain and maintain a CI poly; desired: active Top Secret clearance with SCI eligibility
• Degree in a related field (master's with 6 years, bachelor's with 8 years, associate with 10 years, or 12 years of experience in lieu of a degree)
• IAT III certification under DoD 8570.01-M and DoD Directive 8140 (e.g. CASP+, CCNP Security, CISA, CISSP, GCED, GCIH, CCSP)
• Experience with insider threat detection signatures, log analysis, threat intelligence, incident investigation and root cause analysis
• Strong analytical and investigative mindset and solid communication skills with stakeholders

Required skills

• Knowledge of IC and/or DoD security directives, guidance, policies and procedures, and the DoD Risk Management Framework Manual
• Desired: SIEM or UEBA platform experience (Splunk, Microsoft Sentinel, Elastic, Exabeam), insider threat or DLP tools (DTEX, Forcepoint, Proofpoint ITM, Microsoft Purview, Securonix), and MITRE ATT&CK, CERT Insider Threat Center and NITTF models
• Desired: proficiency in at least one query language (SPL, KQL or SQL) and scripting in Python or PowerShell, detection-as-code with Git, CI/CD pipelines and rollback processes

Salary range estimate: $100,744 - $161,958, with possible annual bonuses, short- and long-term incentives and program-specific awards.